Buffer Overflow in P-Net Due to Unchecked LengthPeerStationName

Executive Summary

P-Net before version 1.0.3 has a buffer overflow vulnerability in the get_check_peer() function. It does not validate the LengthPeerStationName field in a CheckPeers block. The function copies data into a 241-byte buffer using a received length up to 255, including a terminating NUL byte. This causes up to 15 bytes to be written past the buffer's end, potentially leading to crashes or arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

Detection requires monitoring network traffic for malformed P-Net CheckPeers blocks. Use packet capture tools like tcpdump or Wireshark to inspect P-Net protocol traffic for blocks with LengthPeerStationName exceeding 240 bytes. Check for crashes or memory corruption in P-Net applications after receiving such blocks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing the system or allow arbitrary code execution if exploited. An attacker needs adjacent network access to establish a session and send a crafted block to trigger the issue.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade P-Net to version 1.0.3 or later to address the buffer overflow. If upgrading is not immediately possible, restrict network access to trusted adjacent systems only. Monitor for crashes or unusual activity in P-Net services.

Useful 0 Not Useful 0